CVE-2023-3314: OS Command Injection
First published: Mon Jul 03 2023(Updated: )
A vulnerability arises out of a failure to comprehensively sanitize the processing of a zip file(s). Incomplete neutralization of external commands used to control the process execution of the .zip application allows an authorized user to obtain control of the .zip application to execute arbitrary commands or obtain elevation of system privileges.
Credit: trellixpsirt@trellix.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Trellix Enterprise Security Manager | <11.6.7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2023-3314?
CVE-2023-3314 is a vulnerability that arises from the failure to properly sanitize the processing of zip files, allowing an authorized user to execute arbitrary commands.
What is the severity of CVE-2023-3314?
CVE-2023-3314 has a severity rating of 8.8, which is considered high.
Which software is affected by CVE-2023-3314?
Trellix Enterprise Security Manager version 11.6.7 is affected by CVE-2023-3314.
How can an attacker exploit CVE-2023-3314?
An attacker can exploit CVE-2023-3314 by using a specially crafted zip file to execute arbitrary commands.
Is there a fix for CVE-2023-3314?
Yes, it is recommended to update Trellix Enterprise Security Manager to a version that properly sanitizes zip file processing to mitigate CVE-2023-3314.
- collector/nvd-index
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/references
- agent/severity
- agent/author
- agent/weakness
- agent/softwarecombine
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- vendor/trellix
- canonical/trellix enterprise security manager